Back in January, we wrote about a legal challenge to the Netherlands’ data retention law by a group of civil rights organizations. This was because the Dutch government had decided to ignore the important ruling by Europe’s highest court, the Court of Justice of the EU (CJEU), that blanket data retention was “invalid.” Now, a court in The Hague has ruled the government was wrong to do so:
Dutch providers are no longer required to retain internet and phone traffic data. The telecommunications data retention law, that was fought in court by various privacy groups and small ISPs, is invalid.
That was ruled by the court of The Hague on Wednesday. The data retention law violated the Charter of Fundamental Rights of the European Union, specifically regarding the right to protection of private life and protection of personal data.
As that report from Nu.nl, translated by Matthijs R. Koot on his blog, makes clear, the court’s judgment affects all kinds of telecoms — both Internet and phone traffic data — and all communication providers. This is the judge’s reasoning:
The judge finds that the collected data are too easily accessible for crimes that are not serious. The plaintiffs stated that, technically, theft of a bicycle could lead to access to data, although the government stated this does not happen.
“Fact of the matter is that the possibility exists and that no safeguards exist to limit access to the data to what is strictly necessary to fight (only) serious crime”, according to the judge.
The court also finds it to be incorrect that no prior court approval is needed to access the data.
The judge’s ruling is only “provisonally enforeable”, and the Dutch government may appeal against it. But even if it does, it has a larger problem with its policy in this area. Although it claims a new data retention bill will be compatible with the CJEU ruling, the Netherlands’ Data Protection Authority has already said that it is still too intrusive for a number of reasons. Clearly, the European debate over what is a reasonable and proportionate level of data retention — if any — has a long way to go yet, both in the Netherlands and elsewhere.
Tag: Data Retention
Australian Government Prosecuting Anonymous Member Who Allegedly Exposed The Major Flaw In Its Data Retention Demands
Find a security flaw, go to jail. That’s the general attitude of government entities around the world. Over in Australia, an Anonymous member and fundraising manager for a cancer support group is facing an ever-shifting number of charges for finding and testing security holes.
Adam John Bennett is a rather un-anonymous member of Anonymous. He also acts as an unofficial mouthpiece for Anonymous via his LoraxLive online radio show. His supposed participation in a large-scale hack saw him raided by Australian Federal Police in May of 2014. Since then, he’s been awaiting prosecution for a variety of charges — charges government prosecutors seem unable to pin down.
The data breach leading to Bennett’s arrest involved a target of Australia’s controversial data retention law, which requires ISPs to hold onto subscribers’ internet activity (including social network use and emails) for two years and grant extensive access to a variety of government agencies.